When the General Data Protection Regulation (GDPR) first came into force in May 2018, it was widely anticipated that there would be a deluge of class action claims for infringements of data protection laws. The first reason for this anticipation is that the GDPR confers extensive rights on data subjects to make claims for data protection breaches. Under articles 78 – 80 inclusive, data subjects can bring claims against supervisory authorities, controllers and processors. They also have the option to be represented by a not-for-profit body to bring [...]